Duplicate Post
Monthly
Stored cross-site scripting in the WordPress plugin Duplicate Post (copy-delete-posts) through version 1.5.6 lets an authenticated subscriber-level user inject arbitrary JavaScript via the 'noti_token' parameter, which then executes in the browser of anyone who later views the affected page. Exploitation is not unconditional: the site owner must have enabled the plugin's User Level Permissions for the Subscriber role, a non-default setting that exposes the i_saw_this_noti AJAX branch used to deliver the payload, so default installations are not reachable by low-privilege users. No public exploit code has been identified at time of analysis, and no KEV listing applies, though the stored nature of the flaw means a single successful injection can affect privileged administrators and visitors; the vendor has released version 1.5.7 as the fix.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the WordPress plugin Duplicate Post (copy-delete-posts) through version 1.5.6 lets an authenticated subscriber-level user inject arbitrary JavaScript via the 'noti_token' parameter, which then executes in the browser of anyone who later views the affected page. Exploitation is not unconditional: the site owner must have enabled the plugin's User Level Permissions for the Subscriber role, a non-default setting that exposes the i_saw_this_noti AJAX branch used to deliver the payload, so default installations are not reachable by low-privilege users. No public exploit code has been identified at time of analysis, and no KEV listing applies, though the stored nature of the flaw means a single successful injection can affect privileged administrators and visitors; the vendor has released version 1.5.7 as the fix.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The "Duplicate Post" WordPress plugin up to and including version 1.1.9 is vulnerable to SQL Injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.